Splunk Search

Exclude Splunk's own audit trail log in search results?

az365
Engager

HI,

I am new to Splunk. If criteria is met, I notice my search results include my previous searches stored in Splunk's own audit trail. They have:

host = [one of the Splunk nodes]

source = audittrail

sourcetype = audittrail

Is there a way to exclude it? It generates a lot of noise when I am refining my searches.. Thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That will happen if you specify index=_audit in your query.  Don't do that if you don't want to see that data.

It also will happen if your default indexes list includes _* or _audit and you don't specify index name(s) in your query.  Don't do that.  Always include at least one index name in your queries (with few exceptions).

Or specifically exclude that source(type) in your query.

blah blah source!=audittrail blah blah

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That will happen if you specify index=_audit in your query.  Don't do that if you don't want to see that data.

It also will happen if your default indexes list includes _* or _audit and you don't specify index name(s) in your query.  Don't do that.  Always include at least one index name in your queries (with few exceptions).

Or specifically exclude that source(type) in your query.

blah blah source!=audittrail blah blah

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...